CVE-2017-5645: Apache Log4j socket receiver deserialization vulnerability
Severity: High
CVSS Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Vendor: The Apache Software Foundation
Versions Affected: all versions from 2.0-alpha1 to 2.8.1
Description: When using the TCP socket server or UDP
doesn't seem like an ideal way to configure things. It could be more
complicated than it's worth, however.
On 20 April 2017 at 13:22, Matt Sicker <boa...@gmail.com> wrote:
> Interesting comments. In the typical reddit fashion, I propose a Buzzfeed
> listicle on logging based o
bt.
>
> So I guess we cannot do anything about it. Let's move on with the release.
>
> On Thu, Apr 20, 2017 at 8:25 PM, Matt Sicker <boa...@gmail.com> wrote:
>
> > Oh right, that's a difference. Anyways, if this isn't working with SBT,
> how
> > does it work prop
On 21 April 2017 at 01:41, Ralph Goers <ralph.go...@dslextreme.com> wrote:
> I’ve pushed the support for Java 9 and Stackwalker. Java 9 is now required
> to build Log4j in addition to Java 7.
>
> Ralph
>
--
Matt Sicker <boa...@gmail.com>
Oh right, that's a difference. Anyways, if this isn't working with SBT, how
does it work properly with older versions?
On Thu, Apr 20, 2017 at 02:38, Mikael Ståldal <mikael.stal...@magine.com>
wrote:
> You need to build it with Java 8.
>
> On Thu, Apr 20, 2017 at 2:15 AM, M
Chandra
>
> On 20 Apr 2017, 5:33 AM +0530, Matt Sicker <boa...@gmail.com>, wrote:
> > Don't worry about the build failure. We can still merge it. :)
> >
> > On 19 April 2017 at 00:43, Chandra <chandra.tungathur...@rwth-aachen.de
> > wrote:
> >
>
gt; [Help 1]
>
> so, you guys aren’t using the travis for CI? oO
>
> thanks,
> Chandra
>
> On 20 Apr 2017, 11:59 PM +0530, Matt Sicker <boa...@gmail.com>, wrote:
> > That was a Travis build failure, right? That system is even less reliable
> &g
and/or Confidential Information may be contained in this
> message. If you are not the addressee indicated in this message
> (or responsible for delivery of the message to such a person), you may not
> copy or deliver this message to anyone. In such case,
> you should destroy this message and kindl
for at least 72 hours. We need at least 3 +1s from
PMCs along with more +1s than -1s.
--
Matt Sicker <boa...@gmail.com>
ense to me that we migrate also this
>>> subproject over to git. What do you think?
>>>
>>> Cheers,
>>> Dominik
>>>
>>>
>>>
>>
>
--
Matt Sicker <boa...@gmail.com>
owse/LOG4J2-1858
>
> Thanks.
>
> Adrien
>
--
Matt Sicker <boa...@gmail.com>
>> chance that this feature will be ignored like java.util.logging is or
> > >> should be?
> > >>
> > >> Can we stop tying ourselves into unreleased pretzels over a moving
> > target
> > >> since we do not know when Java 9 will be out
JPMS in general to be honest, but I'm just being cynical.
;)
On 23 April 2017 at 11:34, Gary Gregory <garydgreg...@gmail.com> wrote:
> On Apr 23, 2017 9:19 AM, "Matt Sicker" <boa...@gmail.com> wrote:
>
> One potential scenario I see is that many users may just
. Then, after a few years of fragmentation, Oracle gives up and
donates it to the ASF after it's already irrelevant.
On 23 April 2017 at 11:19, Matt Sicker <boa...@gmail.com> wrote:
> One potential scenario I see is that many users may just end up disabling
> JPMS in all their
t/projects/jigsaw/doc/topics/optional.html
>
> :-)
>
> Without knowing the structure of log4j too well I agree the strict
> package hierarchies mandated by JPMS will be a problem. Probably for
> many other projects with more than one artifact as well.
>
> Stefan
>
--
Matt Sicker <boa...@gmail.com>
pen for 72 hours at least. All votes are welcome
> and
> > we encourage everyone to vote, but only Logging PMC votes are counted
> > towards the "official" vote count. As always, at least 3 + 1s are more
> +1s
> > than -1s are required.
> >
> > Dominik
> >
>
--
Matt Sicker <boa...@gmail.com>
gt;>
>> It looks as if all the links to the API docs have been broken. I'll look
>> into it, may take a few hours, though.
>>
>> In the meantime, the docs are at
>> http://logging.apache.org/log4net/release/sdk/index.html - PatternLayout
>> is
>> http://logging.apache.org/log4net/release/sdk/html/T_log4net
>> _Layout_PatternLayout.htm
>>
>> Cheers
>>
>> Stefan
>>
>
>
--
Matt Sicker <boa...@gmail.com>
nt for.
> >
> > Should this switch be made after a release, like with your move to
> > smart pointers?
> >
>
> That would probably make the most sense. Since I'm the only person
> testing it at the moment, merging it in before a release doesn't seem
> like the best solution, as there's likely something that I have
> missed.
>
> -Robert Middleton
>
--
Matt Sicker <boa...@gmail.com>
that work over and over
> > again unless really necessary.
> >
> > We have a JIRA ticket for this:
> > https://issues.apache.org/jira/browse/LOG4J2-1650
> >
> > I have already started by breaking out log4j-server:
> > https://issues.apache.org/jira/brow
;
> I would certainly not expect a java ui on maven central.
>
> On 2 Aug 2017 4:29 p.m., "Matt Sicker" <boa...@gmail.com> wrote:
>
> > Also, as mentioned elsewhere, we should get a Jenkinsfile configured for
> > this project. It would be a good place to experi
othered to think of a good name". Just remove the "util" level IMO.
> >
> > Gary
> >
> > On Mon, Aug 14, 2017 at 12:02 PM, Gary Gregory <garydgreg...@gmail.com>
> > wrote:
> >
> > > Ugh, not a fan, but I'll retract my -1.
> > >
>
; >>>> wrote:
> >>>>>
> >>>>> Hi All,
> >>>>>
> >>>>> I you use nested classes to build loggers, you end up with logger
> >> names
> >>>>> like A$N1, A$N2 and so on.
> >>>>>
> >>>>> If you then set a logger level in a config using "A", it does not
> >>> affect
> >>>>> A$N1 and A$N2 as you might expect, since "$" is not a ".".
> >>>>>
> >>>>> What about treating "$" like a "."?
> >>>>>
> >>>>> Thoughts?
> >>>>>
> >>>>> Gary
> >>>>
> >>>>
> >>>>
> >>>
> >>
>
>
>
--
Matt Sicker <boa...@gmail.com>
> On Aug 14, 2017, at 1:12 PM, Apache Jenkins Server <
> jenk...@builds.apache.org> wrote:
> >
> > See <https://builds.apache.org/job/Log4j%202.x/2980/display/
> redirect?page=changes>
> >
> >
>
>
>
--
Matt Sicker <boa...@gmail.com>
> the web site? I can’t find it in SVN.
>
> Ralph
>
--
Matt Sicker <boa...@gmail.com>
f you can get the scala site checked in I can figure out how to do link
> them.
>
> Ralph
>
> > On Aug 14, 2017, at 7:00 AM, Matt Sicker <boa...@gmail.com> wrote:
> >
> > The Scala site hasn't been committed to SVN as I wasn't exactly sure how
> to
> >
Embedding a single class? I don't see the problem with that. We do it with
several Commons classes.
On 14 August 2017 at 11:59, Gary Gregory wrote:
> Wait a minute? We are embedding a third party jar? Yuk! -1, sorry that is
> not what I thought was happening.
>
> Gary
>
alternative to log4j-core.
> >>>>>
> >>>>
> >>>>
> >>>> I would suggest you look at log4j-api-android. It should provide a
> working implementation of the API on Android. I really don’t see the point
> of doing much more than this on a phone.
> >>> This is on the android branch.
> >>>>
> >>>> Ralph
> >>
> >>
> >
>
>
>
--
Matt Sicker <boa...@gmail.com>
ring your environment? I set my path and JAVA_HOME in
> /etc/profile. The Java installs never mess with that so the only “default”
> Java I have ever seen is the one I have configured.
>
> Ralph
>
> > On Jul 16, 2017, at 9:20 AM, Matt Sicker <boa...@gmail.com> wrote:
> >
&g
<garydgreg...@gmail.com> wrote:
> Is there a CLIRR plugin for Scala? 'cause 'mvn clean clirr:check' blows up.
>
>
> Gary
>
> On Sun, Jul 16, 2017 at 9:41 AM, Matt Sicker <boa...@gmail.com> wrote:
>
> > Hello all, sorry for the delay between release candid
L the wrappers. OK, good. It would have been helpful to include
> the link to the thing I can build from: the distro zip.
>
> So, why is this version 11? It makes no sense to me. There must have been
> an ML discussion I skipped.
>
> Gary
>
> On Sun, Jul 16, 2017 at 9:41 AM, Matt
core/
> appender/rolling/RollingAppenderTempCompressedFilePatternTest.java
> +++ b/log4j-core/src/test/java/org/apache/logging/log4j/core/
> appender/rolling/RollingAppenderTempCompressedFilePatternTest.java
> @@ -38,9 +38,11 @@ import java.util.concurrent.TimeUnit;
> import org.apache.commons.compress.compressors.CompressorException;
> import org.apache.commons.compress.compressors.CompressorStreamFactory;
> import org.apache.commons.compress.utils.IOUtils;
> +import org.apache.commons.lang3.SystemUtils;
> import org.apache.logging.log4j.Logger;
> import org.apache.logging.log4j.core.util.Closer;
> import org.apache.logging.log4j.junit.LoggerContextRule;
> +import org.junit.Assume;
> import org.junit.Before;
> import org.junit.Rule;
> import org.junit.Test;
> @@ -66,6 +68,8 @@ public class RollingAppenderTempCompressedFilePatternTest
> {
>
> @Before
> public void setUp() throws Exception {
> +// Disable this test on MacOS. FileWatcher isn't fast enough to
> work properly.
> +Assume.assumeTrue(!SystemUtils.IS_OS_MAC_OSX);
> this.logger = loggerContextRule.getLogger(
> RollingAppenderTempCompressedFilePatternTest.class.getName());
> }
>
>
>
--
Matt Sicker <boa...@gmail.com>
t;> expected:<rw-r[w--]--> but was:<rw-r[--r]-->
> > >>> [ERROR] FileAppenderPermissionsTest.testFileUserGroupAPI:181
> > >>> expected:<rw[xrwxrwx]> but was:<rw[-r--r--]>
> > >>> [ERROR]
> > RollingAppenderDirectWriteTempCompressedFilePatternTest.testAppender:94
> > >>> No temporary file created during compression
> > >>> [ERROR] Errors:
> > >>> [ERROR] JeroMqAppenderTest.testClientServer:70 » TestTimedOut test
> > >>> timed out after 600...
> > >
> > >
> > >
> >
> >
> > --
>
> Best Regards / Cordialement / С уважением,
>
> Pierrick *HYMBERT* / Пьеррик *ИМБЕР*
>
> *+Pierrick <https://plus.google.com/u/0/105713262389092625238> / Skype /
> LinkedIn <https://linkedin.com/pub/pierrick-hymbert/51/506/357>*
>
--
Matt Sicker <boa...@gmail.com>
Fri, Jul 14, 2017 at 1:49 PM, Matt Sicker <boa...@gmail.com> wrote:
>
> > The old names are all translated to normalized names via some magical
> > regular expressions from what I recall. I should have some time to work
> on
> > Log4j stuff this weekend, so I'll try to
On 16 July 2017 at 13:27, Gary Gregory <garydgreg...@gmail.com> wrote:
>
> "Building Scala 2.10 wrapper for Log4j API 11.0"
>
> Where do you see this?
> Uh?
>
> Gary
>
>
> >
> > Gary
> >
> > On Sun, Jul 16, 2017 at 9:41
.go...@dslextreme.com> wrote:
> This is the effective version of Log4j-API (i.e. the last API version that
> would impact an implementation). That hasn’t changed since 2.6.
>
> Ralph
>
> > On Jul 16, 2017, at 8:59 AM, Matt Sicker <boa...@gmail.com> wrote:
> >
> > If t
p --no-check-certificate
https://repository.apache.org/content/repositories/orgapachelogging-1028/org/apache/logging/log4j/
If that doesn't work, please let me know so I can note the correct command
for future vote emails.
--
Matt Sicker <boa...@gmail.com>
t;> md5sum
>>>>> and compare the to contents of the .md5 file
>>>>>
>>>>> sha1sum
>>>>> and compare the to contents of the .sha1 file
>>>>>
>>>>> Then:
>>>>>
>>>>> gpg
> Ralph
> >
> > > On Jul 9, 2017, at 10:29 AM, Gary Gregory <garydgreg...@gmail.com>
> > wrote:
> > >
> > > But there is a file system on Android...
> > >
> > >> On Jul 9, 2017 10:15, "Matt Sicker" <boa...@gmail.com> wrote:
T IT-Systeme http://www.AM-SoFT.de/
>
> Telefon...05151- 9468- 55
> Fax...05151- 9468- 88
> Mobil..0178-8 9468- 04
>
> AM-SoFT GmbH IT-Systeme, Brandenburger Str. 7c, 31789 Hameln
> AG Hannover HRB 207 694 - Geschäftsführer: Andreas Muchow
>
>
--
Matt Sicker <boa...@gmail.com>
t;> <https://issues.apache.org/jira/browse/LOG4J2-1926>, we are still
>>>> discovering new work and I suspect we will keep discovering new issues
>>>> as
>>>> we start to take an in-depth look. If anything, let's make Android the
>>>> "theme" for Log4j 2.10.
>>>> Java 9 has been on the roadmap for a long time and is finally in a state
>>>> where we can start asking for user feedback on it.
>>>> I don't mind that Java 9 is still not officially released yet; it gives
>>>> us
>>>> some wiggle room in case we need to make changes.
>>>> But I do like the version number symmetry: "Log4j offers Java 9 support
>>>> from version 2.9". Call me a poet. :-)
>>>>
>>>
>>>
>>
>>
>
--
Matt Sicker <boa...@gmail.com>
Forgot to add the link: <https://www.osgi.org/about-us/members/>. Lots of
people involved.
On 10 July 2017 at 17:19, Matt Sicker <boa...@gmail.com> wrote:
> OSGi's biggest contributors are Adobe, Bosch, Deutsche Telekom, Huawei,
> IBM, Liferay, NTT, Oracle (surprisingly), Par
That was just a random example. I can't imagine most of the core appenders
are useful in Android, and that includes the ones that use Java SE classes
only.
On 10 July 2017 at 16:52, Gary Gregory <garydgreg...@gmail.com> wrote:
> On Jul 10, 2017 14:40, "Matt Sicker" <b
com> wrote:
> Even version 6 is three years old... the one we had in there was over 10
> IIRC
>
> G
>
> On Jul 10, 2017 14:42, "Matt Sicker" <boa...@gmail.com> wrote:
>
> > Now I'll admit that I'm not using OSGi anymore nowadays (different
> client,
lass.
> >
> > I would suggest you look at log4j-api-android on the android branch. It
> should provide a working implementation of the API on Android.
> >
> > The answer to your question is, “No”. It routes the Log4j API to the
> android logger, which IMO is the ONLY sensible thing you can do on Android.
> >
> > Ralph
>
--
Matt Sicker <boa...@gmail.com>
On 9 July 2017 at 18:32, Ralph Goers <ralph.go...@dslextreme.com> wrote:
>
>
> > On Jul 9, 2017, at 1:29 PM, Matt Sicker <boa...@gmail.com> wrote:
> >
> > Suppose we have an Android-specific api jar. Then when an Android
> developer
> > gets log4j-a
> >
> > I would suggest you look at log4j-api-android on the android branch. It
> should provide a working implementation of the API on Android.
> >
> > The answer to your question is, “No”. It routes the Log4j API to the
> android logger, which IMO is the ONLY sensible thing you can do on Android.
> >
> > Ralph
>
>
--
Matt Sicker <boa...@gmail.com>
scans -INF directories for code.
On 10 July 2017 at 16:58, Gary Gregory <garydgreg...@gmail.com> wrote:
> On Mon, Jul 10, 2017 at 2:52 PM, Gary Gregory <garydgreg...@gmail.com>
> wrote:
>
> >
> >
> > On Jul 10, 2017 14:40, "Matt Sicker" <boa...@gm
a/src/changes/changes.xml
> +++ b/src/changes/changes.xml
> @@ -208,6 +208,9 @@
>
> Update javax.persistence from 2.1.0 to 2.1.1.
>
> +
> +Update org.osgi.core from 4.3.1 to 6.0.0.
> +
>
>
>
>
>
--
Matt Sicker <boa...@gmail.com>
od if you could finalize the release of logging-log4j-scala.
> I am ready to help.
>
>
> On 2017-07-07 01:04, Matt Sicker wrote:
>
>> The code as is should be ready for source and binary artifacts I believe.
>> I
>> don't recall if there was a distribution zip tas
t; implemented ThreadContext wrapper in LOG4J2-1690.
> >
> > Basically just release what we currently have in the logging-log4j-scala
> Git repo.
> >
> >
> > On 2017-07-05 23:28, Matt Sicker wrote:
> >> So 11.0 would have the old name, and 12.0 would have the new name
l the Apache mirrors.
On 8 July 2017 at 04:26, Thorsten Schöning <tschoen...@am-soft.de> wrote:
> Guten Tag Matt Sicker,
> am Freitag, 7. Juli 2017 um 22:41 schrieben Sie:
>
> > 1. You should add it to the logging project's KEYS file. I think I was
> one
> > of the las
; >
> > - with the project name in the name like META-INF/log4j2.LICENSE
> >
> > - with maven AID in the name like META-INF/log4j-api.LICENSE
> >
> > - with maven coords in the name like META-INF/org.apache.logging.
> log4j-log4j-api.LICENSE
> >
> > As an aside files like LICENSE and NOTICE do not have .txt extensions
> which is lame IMO.
> >
> > Ignore and do nothing? Thoughts?
> >
> > Gary
> >
> >
>
--
Matt Sicker <boa...@gmail.com>
> com.android.dx.cf.direct.DirectClassFile.parse(DirectClassFi
> >> le.java:406)\n\tat
> >> > com.android.dx.cf.direct.DirectClassFile.parseToInterfacesIf
> >> Necessary(DirectClassFile.java:388)\n\tat
> >> > com.android.dx.cf.direct.DirectClassFile.getMagi
driving me nuts!
>
> Sometimes it's "log4j.foo", sometimes it's "log4j*2*.bar", sometimes its
> "bar". WTF!
>
> Can we just PLEASE bite the bullet and make it all "log4j2." or _something_
>
> We could keep the existing names for compat (TDB).
>
> ?
>
> Gary
>
--
Matt Sicker <boa...@gmail.com>
gt; Merge it! :-)
>
> Did you bother to keep the old names for compat?
>
> G
>
> On Fri, Jul 14, 2017 at 1:47 PM, Matt Sicker <boa...@gmail.com> wrote:
>
> > I have an open branch that fixes all this. The only remaining work there
> is
> > to clean up merge c
> - "packages" are not picked up
>
> Is that what would happen?
>
> Gary
>
--
Matt Sicker <boa...@gmail.com>
code?
- This would also cover when to use which level, what kind of information
to log, etc.
* How can we effectively manage logs in distributed systems? (might be too
advanced a topic?)
--
Matt Sicker <boa...@gmail.com>
env.XDG_RUNTIME_DIR=/run/user/10025, env.WORKSPACE=<https://builds.
> apache.org/job/Log4j%202.x/ws/,> ROOT_BUILD_CAUSE_MANUALTRIGGER=true,
> maven.version=3.3.9, env.GIT_PREVIOUS_SUCCESSFUL_COMMIT=
> 698bf360f3880eefdf58989ef63911b955602f2d,
> PATH+JDK=/home/jenkins/tools/java/latest1.8/b
; >> /usr/local/asfpackages/java/jdk1.8.0_131/jre/../lib/jconsole.jar]
> >>
> >> Java is not going to be able to read the classes in the jconsole jar.
> >>
> >> Ralph
> >>
> >>
> >>
> >>
> >>
>
>
> Ralph
>
> > On Jul 8, 2017, at 9:10 PM, Gary Gregory <garydgreg...@gmail.com> wrote:
> >
> > On Sat, Jul 8, 2017 at 7:47 PM, Matt Sicker <boa...@gmail.com> wrote:
> >
> >> Seems simpler to fix the Gradle plugin(s) for Android honestly.
> &
for XML
> examples do we mention that the configuration element name is actually
> "JMS" and not "JMSAppender". I'm going to replace "JMSAppender" with "JMS
> Appender" in the docs to make that point.
>
> Feel free to update other a
If the version number is an issue and we'd prefer a different module name
with a version 1.0, then everything changes quite a bit. If we want to use
a smaller version number as the initial release, that's a lot simpler.
On 16 July 2017 at 18:34, Matt Sicker <boa...@gmail.com> wrote:
> A
the link to the thing I can build from: the distro zip.
> >>>>
> >>>> So, why is this version 11? It makes no sense to me. There must have
> >>>> been
> >>>> an ML discussion I skipped.
> >>>>
> >>>>
> >>
ns, the only change is what you'd
> expect: the tree view is expanded or collapsed. There is no navigation. If
> you click on the text next to a chevron, then you navigate.
>
> That's not what our site does :-(
>
> Gary
>
>
>
> > You can click anyplace on the line and it will still take you to the
> page.
> > If you check the HTML, if it is open it is
> >
> >
> >
> > while the closed is
> >
> >
> >
> > -Robert Middleton
> >
>
--
Matt Sicker <boa...@gmail.com>
s to be used to compile and test using Java 7.
>
> The fix for this is to configure the Jenkins job to use Java 8 by default
> and to use the Java 7 toolchain when a system property is set. I’ve done
> that and am re-running the build.
>
> Ralph
>
> > On Jul 16, 2017, at 11:29 A
gt; Not sure how I am supposed to check the ASC, MD5 and SHA1 files
> in a
> > >>>>>> convenient way.
> > >>>>>>
> > >>>>>>
> > >>>>> On Cygwin/Linux:
> > >>>>>
> > >>>>> md5sum
>
Sun, Jul 16, 2017 at 10:02 AM, Matt Sicker <boa...@gmail.com> wrote:
>
> > I found the issues:
> >
> > https://issues.apache.org/jira/browse/LOG4J2-1431 (for the system
> > properties normalization)
> > https://issues.apache.org/jira/browse/LOG4J2-1809 (for th
gt;> DefaultConfigurationBuilder
> >> ConfigurationBuilder
> >> MutableLogEvent
> >> AbstractConfiguration
> >> Log4jLogEvent
> >> RingBufferLogEven
> >>
> >> Could you please take a look and tell me if it's viable?
> >>
> >> Maybe some of these classes could benefit from some kind of refactoring
> >> that we can discuss.
> >>
>
>
>
--
Matt Sicker <boa...@gmail.com>
As for the 2.12 IBM JDK bug, could be worth filing a jira ticket over it.
Since they don't seem to publish the IBM JDK for macOS, that may make it
harder to test a fix, but we can possibly make a Dockerfile for it.
On 20 July 2017 at 21:18, Matt Sicker <boa...@gmail.com> wrote:
>
er.
On 20 July 2017 at 21:22, Matt Sicker <boa...@gmail.com> wrote:
> As for the 2.12 IBM JDK bug, could be worth filing a jira ticket over it.
> Since they don't seem to publish the IBM JDK for macOS, that may make it
> harder to test a fix, but we can possibly make a Dockerfile fo
I did find this Scala issue: https://github.com/scala/bug/issues/10417
On 20 July 2017 at 22:07, Gary Gregory <garydgreg...@gmail.com> wrote:
> On Thu, Jul 20, 2017 at 7:22 PM, Matt Sicker <boa...@gmail.com> wrote:
>
> > As for the 2.12 IBM JDK bug, could be worth f
Gregory <garydgreg...@gmail.com> wrote:
> On Thu, Jul 20, 2017 at 7:22 PM, Matt Sicker <boa...@gmail.com> wrote:
>
> > As for the 2.12 IBM JDK bug, could be worth filing a jira ticket over it.
> >
>
> Creating a JIRA/issue where though? In IBM's system?
>
> Gar
Logged internally: https://issues.apache.org/jira/browse/LOG4J2-1983
On 20 July 2017 at 22:22, Matt Sicker <boa...@gmail.com> wrote:
> I did find this Scala issue: https://github.com/scala/bug/issues/10417
>
> On 20 July 2017 at 22:07, Gary Gregory <garydgreg...@gmail.com&g
: 'sbt clean run' and it hangs hard with IBM
> Java,
> > CTRL-C does nothing: https://pastebin.com/HWYniJXB
> >
> > Gary
> >
> > On Thu, Jul 20, 2017 at 1:25 PM, Matt Sicker <boa...@gmail.com> wrote:
> >
> >> The sbt script is just added
t;- 2.11.11 Hello, world!
>- 2.12.1 crashes
>- 2.12.0 crashes
>
> How do I update the sbt file to test 2.13.0-M1?
>
> Gary
>
>
>
>
> On Thu, Jul 20, 2017 at 6:27 PM, Matt Sicker <boa...@gmail.com> wrote:
>
> > Can you try changing the Scala
eaming appender
> (Console, any File or Socket with protocol=tcp/ssl), the layout needs to
> provide some way to delimit log events.
>
>
>
> On 2017-07-20 22:28, Matt Sicker wrote:
>
>> I'm not a fan of the null termination as it is. Do you know how many
>> millions or bil
017 at 11:31 AM, Matt Sicker <boa...@gmail.com> wrote:
>
> > If the size of the message is known ahead of time, you can create a
> simple
> > framing protocol around messages as well.
> >
> > On 21 July 2017 at 07:23, Mikael Ståldal <mi...
Agreed. I'll finish this up either today or over the weekend.
On 21 July 2017 at 07:17, Mikael Ståldal <mi...@apache.org> wrote:
> Then I don't think this should block our release.
>
>
> On 2017-07-21 05:30, Matt Sicker wrote:
>
>> Logged internally: https://issues.ap
wrote:
> And then, you'll remove the Scala modules from the main repo's master?
>
> Gary
>
> On Fri, Jul 21, 2017 at 11:30 AM, Matt Sicker <boa...@gmail.com> wrote:
>
> > Agreed. I'll finish this up either today or over the weekend.
> >
> > On 21 July
;>
>>>> On Mon, Jul 24, 2017 at 12:56 PM, Mikael Ståldal <mi...@apache.org>
>>>> wrote:
>>>>
>>>> But that won't work, I need to at least translate
>>>> JsonProcessingException
>>>>
>>>>> (Jackson specific, which we don't want to expose) to our own
>>>>> ParseException.
>>>>>
>>>>>
>>>>>
>>>>> On 2017-07-23 22:01, Gary Gregory wrote:
>>>>>
>>>>>@Override
>>>>>
>>>>>>public LogEvent parseFrom(InputStream input) throws
>>>>>> IOException,
>>>>>> ParseException {
>>>>>>return objectReader.readValue(input);
>>>>>>}
>>>>>>
>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>>
>
--
Matt Sicker <boa...@gmail.com>
2:01, Gary Gregory wrote:
>
>> @Override
>> public LogEvent parseFrom(InputStream input) throws IOException,
>> ParseException {
>> return objectReader.readValue(input);
>> }
>>
>
--
Matt Sicker <boa...@gmail.com>
But some of the methods threw a runtime exception which could just be
another type of parse exception if differentiation is necessary.
On 23 July 2017 at 21:16, Gary Gregory <garydgreg...@gmail.com> wrote:
> On Jul 23, 2017 19:10, "Matt Sicker" <boa...@gmail.com>
rethrow(e) doesn't wrap the exception, so there's no useless exception.
On 24 July 2017 at 15:34, Mikael Ståldal <mi...@apache.org> wrote:
> I could use "Throwables.rethrow(e)", but is that really better than "throw
> new RuntimeException(e)"?
>
>
>
g/apache/logging/log4j/core/
> >>>>> parser/YamlLogEventParser.java
> >>>>> new file mode 100644
> >>>>> index 000..59b3463
> >>>>> --- /dev/null
> >>>>> +++ b/log4j-core/src/main/java/org/apache/logging/log4j/core/
> >>>>> parser/YamlLogEventParser.java
> >>>>> @@ -0,0 +1,33 @@
> >>>>> +/*
> >>>>> + * Licensed to the Apache Software Foundation (ASF) under one or
> more
> >>>>> + * contributor license agreements. See the NOTICE file distributed
> >>>>> with
> >>>>> + * this work for additional information regarding copyright
> ownership.
> >>>>> + * The ASF licenses this file to You under the Apache license,
> Version
> >>>>> 2.0
> >>>>> + * (the "License"); you may not use this file except in compliance
> >>>>> with
> >>>>> + * the License. You may obtain a copy of the License at
> >>>>> + *
> >>>>> + * http://www.apache.org/licenses/LICENSE-2.0
> >>>>> + *
> >>>>> + * Unless required by applicable law or agreed to in writing,
> software
> >>>>> + * distributed under the License is distributed on an "AS IS" BASIS,
> >>>>> + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> >>>>> implied.
> >>>>> + * See the license for the specific language governing permissions
> and
> >>>>> + * limitations under the license.
> >>>>> + */
> >>>>> +package org.apache.logging.log4j.core.parser;
> >>>>> +
> >>>>> +import org.apache.logging.log4j.core.LogEvent;
> >>>>> +import org.apache.logging.log4j.core.impl.Log4jLogEvent;
> >>>>> +import org.apache.logging.log4j.core.jackson.Log4jXmlObjectMapper;
> >>>>> +import org.apache.logging.log4j.core.jackson.Log4jYamlObjectMapper;
> >>>>> +
> >>>>> +/**
> >>>>> + * Parse the output from YamlLayout layout into instances of {@link
> >>>>> LogEvent}.
> >>>>> + */
> >>>>> +public class YamlLogEventParser extends
> AbstractJacksonLogEventParser
> >>>>> {
> >>>>> +
> >>>>> +public YamlLogEventParser() {
> >>>>> +super(new Log4jYamlObjectMapper().reader
> >>>>> For(Log4jLogEvent.class));
> >>>>> +}
> >>>>> +
> >>>>> +}
> >>>>>
> >>>>> http://git-wip-us.apache.org/repos/asf/logging-log4j2/blob/
> >>>>> c4814a87/log4j-core/src/main/java/org/apache/logging/log4j/
> >>>>> core/parser/package-info.java
> >>>>>
> --
> >>>>> diff --git a/log4j-core/src/main/java/org
> >>>>> /apache/logging/log4j/core/par
> >>>>> ser/package-info.java
> >>>>> b/log4j-core/src/main/java/org/apache/logging/log4j/core/
> >>>>> parser/package-info.java
> >>>>> new file mode 100644
> >>>>> index 000..3506570
> >>>>> --- /dev/null
> >>>>> +++ b/log4j-core/src/main/java/org/apache/logging/log4j/core/
> >>>>> parser/package-info.java
> >>>>> @@ -0,0 +1,20 @@
> >>>>> +/*
> >>>>> + * Licensed to the Apache Software Foundation (ASF) under one or
> more
> >>>>> + * contributor license agreements. See the NOTICE file distributed
> >>>>> with
> >>>>> + * this work for additional information regarding copyright
> ownership.
> >>>>> + * The ASF licenses this file to You under the Apache license,
> Version
> >>>>> 2.0
> >>>>> + * (the "License"); you may not use this file except in compliance
> >>>>> with
> >>>>> + * the License. You may obtain a copy of the License at
> >>>>> + *
> >>>>> + * http://www.apache.org/licenses/LICENSE-2.0
> >>>>> + *
> >>>>> + * Unless required by applicable law or agreed to in writing,
> software
> >>>>> + * distributed under the License is distributed on an "AS IS" BASIS,
> >>>>> + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> >>>>> implied.
> >>>>> + * See the license for the specific language governing permissions
> and
> >>>>> + * limitations under the license.
> >>>>> + */
> >>>>> +/**
> >>>>> + * Parsers for the output of various layouts.
> >>>>> + */
> >>>>> +package org.apache.logging.log4j.core.parser;
> >>>>>
> >>>>> http://git-wip-us.apache.org/repos/asf/logging-log4j2/blob/
> >>>>> c4814a87/log4j-core/src/test/java/org/apache/logging/log4j/c
> >>>>> ore/parser/
> >>>>> JsonLogEventParserTest.java
> >>>>>
> --
> >>>>> diff --git a/log4j-core/src/test/java/org/apache/logging/log4j/core/
> >>>>> parser/JsonLogEventParserTest.java b/log4j-core/src/test/java/
> >>>>> org/apache/logging/log4j/core/parser/JsonLogEventParserTest.java
> >>>>> new file mode 100644
> >>>>> index 000..5684602
> >>>>> --- /dev/null
> >>>>> +++ b/log4j-core/src/test/java/org/apache/logging/log4j/core/
> >>>>> parser/JsonLogEventParserTest.java
> >>>>> @@ -0,0 +1,103 @@
> >>>>> +/*
> >>>>> + * Licensed to the Apache Software Foundation (ASF) under one or
> more
> >>>>> + * contributor license agreements. See the NOTICE file distributed
> >>>>> with
> >>>>> + * this work for additional information regarding copyright
> ownership.
> >>>>> + * The ASF licenses this file to You under the Apache license,
> Version
> >>>>> 2.0
> >>>>> + * (the "License"); you may not use this file except in compliance
> >>>>> with
> >>>>> + * the License. You may obtain a copy of the License at
> >>>>> + *
> >>>>> + * http://www.apache.org/licenses/LICENSE-2.0
> >>>>> + *
> >>>>> + * Unless required by applicable law or agreed to in writing,
> software
> >>>>> + * distributed under the License is distributed on an "AS IS" BASIS,
> >>>>> + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> >>>>> implied.
> >>>>> + * See the license for the specific language governing permissions
> and
> >>>>> + * limitations under the license.
> >>>>> + */
> >>>>> +package org.apache.logging.log4j.core.parser;
> >>>>> +
> >>>>> +import org.apache.logging.log4j.core.LogEvent;
> >>>>> +import org.junit.Before;
> >>>>> +import org.junit.Test;
> >>>>> +
> >>>>> +import static org.junit.Assert.assertEquals;
> >>>>> +import static org.junit.Assert.assertNotNull;
> >>>>> +
> >>>>> +public class JsonLogEventParserTest {
> >>>>> +
> >>>>> +private JsonLogEventParser parser;
> >>>>> +
> >>>>> +private static final String JSON = "{\n" +
> >>>>> +" \"timeMillis\" : 1493121664118,\n" +
> >>>>> +" \"thread\" : \"main\",\n" +
> >>>>> +" \"level\" : \"INFO\",\n" +
> >>>>> +" \"loggerName\" : \"HelloWorld\",\n" +
> >>>>> +" \"marker\" : {\n" +
> >>>>> +"\"name\" : \"child\",\n" +
> >>>>> +"\"parents\" : [ {\n" +
> >>>>> +" \"name\" : \"parent\",\n" +
> >>>>> +" \"parents\" : [ {\n" +
> >>>>> +"\"name\" : \"grandparent\"\n" +
> >>>>> +" } ]\n" +
> >>>>> +"} ]\n" +
> >>>>> +" },\n" +
> >>>>> +" \"message\" : \"Hello, world!\",\n" +
> >>>>> +" \"thrown\" : {\n" +
> >>>>> +"\"commonElementCount\" : 0,\n" +
> >>>>> +"\"name\" : \"java.lang.RuntimeException\",\n" +
> >>>>> +"\"extendedStackTrace\" : [ {\n" +
> >>>>> +" \"class\" : \"logtest.Main\",\n" +
> >>>>> +" \"method\" : \"main\",\n" +
> >>>>> +" \"file\" : \"Main.java\",\n" +
> >>>>> +" \"line\" : 29,\n" +
> >>>>> +" \"exact\" : true,\n" +
> >>>>> +" \"location\" : \"classes/\",\n" +
> >>>>> +" \"version\" : \"?\"\n" +
> >>>>> +"} ]\n" +
> >>>>> +" },\n" +
> >>>>> +" \"contextStack\" : [ \"one\", \"two\" ],\n" +
> >>>>> +" \"endOfBatch\" : false,\n" +
> >>>>> +" \"loggerFqcn\" :
> >>>>> \"org.apache.logging.log4j.spi.AbstractLogger\",\n"
> >>>>> +
> >>>>> +" \"contextMap\" : {\n" +
> >>>>> +"\"bar\" : \"BAR\",\n" +
> >>>>> +"\"foo\" : \"FOO\"\n" +
> >>>>> +" },\n" +
> >>>>> +" \"threadId\" : 1,\n" +
> >>>>> +" \"threadPriority\" : 5,\n" +
> >>>>> +" \"source\" : {\n" +
> >>>>> +"\"class\" : \"logtest.Main\",\n" +
> >>>>> +"\"method\" : \"main\",\n" +
> >>>>> +"\"file\" : \"Main.java\",\n" +
> >>>>> +"\"line\" : 29\n" +
> >>>>> +" }\n" +
> >>>>> +"}";
> >>>>> +
> >>>>> +@Before
> >>>>> +public void setup() {
> >>>>> +parser = new JsonLogEventParser();
> >>>>> +}
> >>>>> +
> >>>>> +@Test
> >>>>> +public void testString() throws ParseException {
> >>>>> +LogEvent logEvent = parser.parseFrom(JSON);
> >>>>> +assertNotNull(logEvent);
> >>>>> +assertEquals("HelloWorld", logEvent.getLoggerName());
> >>>>> +// TODO assert more here
> >>>>> +}
> >>>>> +
> >>>>> +@Test(expected = ParseException.class)
> >>>>> +public void testStringEmpty() throws ParseException {
> >>>>> +parser.parseFrom("");
> >>>>> +}
> >>>>> +
> >>>>> +@Test(expected = ParseException.class)
> >>>>> +public void testStringInvalidJson() throws ParseException {
> >>>>> +parser.parseFrom("foobar");
> >>>>> +}
> >>>>> +
> >>>>> +@Test(expected = ParseException.class)
> >>>>> +public void testStringInvalidProperty() throws ParseException {
> >>>>> +parser.parseFrom("{\"foo\":\"bar\"}");
> >>>>> +}
> >>>>> +
> >>>>> +}
> >>>>>
> >>>>> http://git-wip-us.apache.org/repos/asf/logging-log4j2/blob/
> >>>>> c4814a87/src/changes/changes.xml
> >>>>>
> --
> >>>>> diff --git a/src/changes/changes.xml b/src/changes/changes.xml
> >>>>> index 074e31c..522f49b 100644
> >>>>> --- a/src/changes/changes.xml
> >>>>> +++ b/src/changes/changes.xml
> >>>>> @@ -31,6 +31,9 @@
> >>>>> - "remove" - Removed
> >>>>>-->
> >>>>>
> >>>>> +
> >>>>> +Public API for parsing the output from
> >>>>> JsonLayout/XmlLayout/YamlLayout
> >>>>> into a LogEvent.
> >>>>> +
> >>>>>
> >>>>>Allow maxLength of StructuredData to be specified by the
> >>>>> user.
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>
> >>>
> >>
> >
>
--
Matt Sicker <boa...@gmail.com>
2:14 PM, Ralph Goers <ralph.go...@dslextreme.com>
> wrote:
>
> > Is this a vote thread or a discussion thread? Was there a vote result?
> >
> > Ralph
> >
> > > On Jul 22, 2017, at 12:56 PM, Matt Sicker <boa...@gmail.com> wrote:
> > >
>
hen we can update the site and send an
announcement email.
On 24 July 2017 at 12:04, Matt Sicker <boa...@gmail.com> wrote:
> +1 from me.
>
> This vote passes with 3 +1 votes from myself, Gary, and Mikael. I'll
> continue with the release.
>
> On 23 July 2017 at 21:10, Matt S
nitely harmless.
> >
> > The build goes on and eventually crashes the IBM JVM:
> >>
> >
> > I have not seen and such crash. Does it crash Oracle JVM too, or only
> IBM?
> > I haven't tried IBM JVM for this.
> >
>
> Only IBM. My review states "Building it worked for me from the src zip with
> 'mvn clean install site'." and just below that I show the 'mvn -version'
> output which includes the Oracle JVM version.
>
> Gary
>
--
Matt Sicker <boa...@gmail.com>
https://github.com/jvz/test-log4j-scala
Clone this and run "sbt run" or "./sbt run". It should print out a single
info-level "Hello, world!" log message.
On 20 July 2017 at 14:03, Matt Sicker <boa...@gmail.com> wrote:
> I can write a test project that
found
> ./sbt: line 47: syntax error near unexpected token `$'{\r''
> '/sbt: line 47: `onSbtRunnerExit() {
>
> I don't want to take the time to set up a VirtualBox for Linux today, sorry
> :-(
>
> Gary
>
> On Thu, Jul 20, 2017 at 12:14 PM, Matt Sicker <boa...@gmail.com>
ullDelimiter option to terminate each log event with a 0-byte.
>
> Would it be useful to have the same in any other layout?
>
> I could think of HtmlLayout, SyslogLayout and RFC5424Layout.
>
--
Matt Sicker <boa...@gmail.com>
gt;>>>>
> >>>>>>>> Ralph
> >>>>>>>>
> >>>>>>>> On Jun 29, 2017, at 6:02 AM, Mikael Ståldal <mi...@apache.org>
> wrote:
> >>>>>>>>>
> >>>>>>>>> Yes, but in this case I want something more which cannot be
> placed in
> >>>>>>>>> changes.xml.
> >>>>>>>>>
> >>>>>>>>> On 2017-06-29 14:37, Remko Popma wrote:
> >>>>>>>>>
> >>>>>>>>>> Release Notes = changes.xml, no?
> >>>>>>>>>> (Shameless plug) Every java main() method deserves
> >>>>> http://picocli.info
> >>>>>>>>>>
> >>>>>>>>>>> On Jun 29, 2017, at 19:48, Mikael Ståldal <mi...@apache.org>
> wrote:
> >>>>>>>>>>>
> >>>>>>>>>>> Do we have any place to prepare release notes for an upcoming
> >>>>> release,
> >>>>>>>>>>> before actually making the release?
> >>>>>>>>>>>
> >>>>>>>>>>> Removing SerializedLayout as default warrants a mentioning in
> the
> >>>>>>>>>>> release notes for the 2.9 release, since it is a breaking
> change.
> >>>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>
> >
> >
>
>
>
--
Matt Sicker <boa...@gmail.com>
(Alternatively, setting system property
> log4j2.debug will also print internal Log4j2 logging
> + to the console, including internal logging that took
> place before the configuration file was found.)
> +
>
>
> strict
> @@ -1315,6 +1319,9 @@ rootLogger.appenderRef.stdout.ref = STDOUT
>
>
> Troubleshooting tip for the impatient:
> + From log4j-2.9 onward, log4j2 will print all internal
> logging to the console if system property
> +log4j2.debug is defined (with any or no
> value).
> + Prior to log4j-2.9, there are two places where internal
> logging can be controlled:
>
>Before a configuration is found, status logger level
> can be controlled with system
>property org.apache.logging.
> log4j.simplelog.StatusLogger.level.
> @@ -1575,6 +1582,7 @@ public class AwesomeTest {
> Default Value
> Description
>
> +
>
> log4j.configurationFile
>
> @@ -1584,6 +1592,14 @@ public class AwesomeTest {
>
>
>
> +log4j2.debug
> +
> +
> + Log4j2 will print all internal logging to the console if system
> property
> + log4j2.debug is defined (with any or no value).
> +
> +
> +
> log4j.mergeFactory
>
>
>
>
--
Matt Sicker <boa...@gmail.com>
ecific, so we don't need to worry
> about it. https://github.com/qos-ch/logback-beagle
>
> Do we know of any other?
>
--
Matt Sicker <boa...@gmail.com>
assemblies if they actually work
> * ... there is surely even more to do
>
> Step forward if you would like to get involved! :-)
>
> Cheers!
> --
> Dominik Psenner
>
--
Matt Sicker <boa...@gmail.com>
Oh, I missed the context line. It's part of the tag already.
On 28 June 2017 at 12:02, Mikael Ståldal <mi...@apache.org> wrote:
> I just did that, didn't I?
>
>
>
> On 2017-06-28 18:57, Gary Gregory wrote:
>
>> On Jun 28, 2017 08:54, "Matt Sicker" <
An alternative layout containing the same information is href="#JSONLayout">JsonLayout,
> - when configured with properties="true".
> + This layout is deprecated since version 2.9. Java Serialization
> has inherent security weaknesses,
> + using this layout is no longer recommended. An alternative
> layout containing the same information
> + is JsonLayout, configured with
> properties="true".
>
>
>
>
>
--
Matt Sicker <boa...@gmail.com>
wrote:
> On Thu, Jul 6, 2017 at 2:31 PM, Matt Sicker <boa...@gmail.com> wrote:
>
> > I attempted a release, and we fixed something, but I was still unsure as
> to
> > how to build the website as the site:stage goal fails with missing file
> > errors if I recal
July 2017 at 15:15, Mikael Ståldal <mi...@apache.org> wrote:
> But this long package name is already out released for Scala 2.10 and
> 2.11. I suggest we release for 2.12 with the same package name, and then
> maybe change it in the next release.
>
>
>
> On 2017-07-
t;>>> etc, but I imagine splitting log4j-core into 5 or more new modules
> >>> will
> >>>>> also cause confusion... It won't be trivial for users to figure out
> >>> which
> >>>>> of the many modules they do or don't need. The coa
th "Java" or "Maven" in
> discussions and documentation to avoid confusion from now on...
>
> Gary
>
> On Apr 25, 2017 10:59 AM, "Matt Sicker" <boa...@gmail.com> wrote:
>
> > If you browse around the Java 9 javadocs, you'll see that they s
1 - 100 of 4673 matches
Mail list logo